message-cp 0.0.0-stage → 0.1.0

package/dist/http.js

@@ -0,0 +1,1933 @@
+import { randomUUID } from "node:crypto";
+import { IncomingMessage, ServerResponse, createServer as createHttpServer } from "node:http";
+import { PassThrough } from "node:stream";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { LATEST_PROTOCOL_VERSION, isInitializeRequest, isJSONRPCRequest } from "@modelcontextprotocol/sdk/types.js";
+import { accountForToken, accountName, listApprovals } from "./accounts.js";
+import { DEFAULT_LIST_LIMIT, MAX_LIST_LIMIT, PersonError, ToolError, WrongPersonError, markWaiting, nameOfIdentity, ownAgentOf, registerWithIdentity, registeredBy } from "./agents.js";
+import { DEFAULT_CHANNEL_LIMIT, MAX_CHANNEL_LIMIT, listAccountChannels, postAsPerson, readAccountChannel, } from "./channels.js";
+import { APPROVE_HEADERS, approvePage, errorPage } from "./approve.js";
+import { mcpEndpoint } from "./connect.js";
+import { DASHBOARD_FONTS, DASHBOARD_HEADERS, DASHBOARD_HTML } from "./dashboard.js";
+import { LoginError, LoginRefused, NotAdminError, OwnPersonError, addInvitedPerson, addTokenBy, cancelInvite, dashboardUrl, endSigninBy, listAccountPeople, listInvites, loginLink, makeInvite, redeemLoginCode, listWebhooksBy, removeAgentBy, removeWebhookBy, addWebhookBy, listSigninsBy, listTokensBy, revokeApprovalBy, revokeTokenBy, resetAgentKeyBy, removePersonBy, setAdminBy, } from "./login.js";
+import { DEFAULT_INBOX_LIMIT, MAX_INBOX_LIMIT, deleteConversation, hasUnread, listAccountMessages, listAgentsUnread, searchAccount, sendAsPerson, unreadSummary, } from "./messages.js";
+import { fetchClientMetadata } from "./client-metadata.js";
+import { OAuthError, approveAuthorization, checkMetadataUrl, clientFromMetadata, exchangeCode, isMetadataUrl, redirectTo, registerClient, startAuthorization, freeAgentName, } from "./oauth.js";
+import { DEFAULT_MAX_SESSIONS, Session, createServer } from "./server.js";
+import { endSession, forgetIdleSessions, restorableSession, saveSession, sessionEnded, touchSession } from "./sessions.js";
+import { DEFAULT_WAIT_HOLD_MS, formatUnread } from "./wait.js";
+import { WebhookError, listAccountDeliveries, sendOptions, sendPending } from "./webhooks.js";
+export const DEFAULT_HTTP_PORT = 8787;
+export const DEFAULT_HTTP_HOST = "127.0.0.1";
+export const DEFAULT_IDLE_TIMEOUT_MS = 30 * 60 * 1000;
+const MAX_BODY_BYTES = 4 * 1024 * 1024;
+/**
+ * The body limit for POST /api/send and /api/post. A 4000-character body is at most 48 KiB as JSON (12 bytes for an
+ * escaped astral character), so this fits any valid request, and a full cap of them buffers at most 16 MiB.
+ */
+const MAX_PERSON_BODY_BYTES = 64 * 1024;
+/** What POST /api/send and /api/post answer a full token, which acts as no person, with its 403. */
+const FULL_TOKEN_SENDS = "A full token cannot send or post as a person. Sign in as a person to send: run message-cp login-link --url <public url> --account <account> --person <name> on the server";
+/** What the /api/people and /api/invites routes answer a full token, which is no admin person, with its 403. */
+const FULL_TOKEN_INVITES = "A full token cannot add, mark or remove people or make invites. Sign in as an admin person: run message-cp login-link --url <public url> --account <account> --person <name> on the server";
+/** What DELETE /api/agents and POST /api/agents/key answer a full token, which is no admin person, with its 403. */
+const FULL_TOKEN_AGENTS = "A full token cannot remove agents or reset their keys. Run message-cp agent remove or agent key reset on the server, or sign in as an admin person: run message-cp login-link --url <public url> --account <account> --person <name> on the server";
+/** The fields a POST /api/webhooks body may have. */
+const WEBHOOK_FIELDS = ["url", "on", "includeText", "header", "maxPerHour", "body"];
+/** What GET, POST and DELETE /api/webhooks answer a full token, which is no admin person, with its 403. */
+const FULL_TOKEN_WEBHOOKS = "A full token cannot list, add or remove webhooks over the API. Run message-cp webhook list, webhook add or webhook remove on the server, or sign in as an admin person: run message-cp login-link --url <public url> --account <account> --person <name> on the server";
+/** What DELETE /api/approvals answers a full token, which is no admin person, with its 403. */
+const FULL_TOKEN_APPROVALS = "A full token cannot revoke approved clients over the API. Run message-cp token list, then message-cp token revoke <id>, on the server, or sign in as an admin person: run message-cp login-link --url <public url> --account <account> --person <name> on the server";
+/** What /api/tokens answers a full token, which is no admin person, with its 403. */
+const FULL_TOKEN_TOKENS = "A full token cannot list, make or revoke tokens over the API. Run message-cp token list, token add <account> --read-only or --agent-only, or token revoke <id> on the server, or sign in as an admin person: run message-cp login-link --url <public url> --account <account> --person <name> on the server";
+/** What /api/signins answers a full token, which is no admin person, with its 403. */
+const FULL_TOKEN_SIGNINS = "A full token cannot list or end dashboard sign-ins over the API. Sign in as an admin person: run message-cp login-link --url <public url> --account <account> --person <name> on the server, or run message-cp token revoke <id> on the server to end every sign-in of a token";
+/** The body limit for the OAuth registration, approval and token endpoints, which take a few short fields. */
+const MAX_OAUTH_BODY_BYTES = 16 * 1024;
+/** An agent seen this recently counts as online in GET /api/agents, as does one with a GET /wait held now. */
+export const ONLINE_WINDOW_MS = 5 * 60 * 1000;
+/** How often a pass over the webhook delivery queue is due; a tick while a pass is still running is skipped. */
+export const DEFAULT_WEBHOOK_INTERVAL_MS = 5000;
+const isBusy = (err) => {
+    const code = err?.code;
+    return typeof code === "string" && code.startsWith("SQLITE_BUSY");
+};
+/**
+ * Runs the database work that keeps a registered session restorable. It never throws: if it fails, the session works
+ * as before, but the work is not retried, so a restart may lose the session. A lock held past the busy timeout is
+ * skipped quietly; any other error logs one fixed line, never anything about the session. Returns false if the lock was
+ * held past the busy timeout.
+ */
+function recordSession(work) {
+    try {
+        work();
+    }
+    catch (err) {
+        if (isBusy(err))
+            return false;
+        console.error("message-cp serve: could not record a session for restarts");
+    }
+    return true;
+}
+/**
+ * Initializes a new transport for a restored session in-process, so that it accepts the client's requests on the
+ * session id it already holds. The transport accepts nothing but an initialize until it has handled one. Its answer
+ * is discarded; the server reads nothing from it.
+ */
+async function prime(transport) {
+    const socket = new PassThrough();
+    socket.resume();
+    const req = new IncomingMessage(socket);
+    req.method = "POST";
+    req.url = "/mcp";
+    // The transport builds a URL from the Host header, so it needs one; nothing else reads it.
+    const headers = { host: DEFAULT_HTTP_HOST, "content-type": "application/json", accept: "application/json, text/event-stream" };
+    req.headers = headers;
+    req.rawHeaders = Object.entries(headers).flat();
+    req.push(null);
+    const res = new ServerResponse(req);
+    res.assignSocket(socket);
+    const finished = new Promise((resolve) => res.on("finish", () => resolve()));
+    await transport.handleRequest(req, res, {
+        jsonrpc: "2.0",
+        id: 0,
+        method: "initialize",
+        params: { protocolVersion: LATEST_PROTOCOL_VERSION, capabilities: {}, clientInfo: { name: "message-cp restore", version: "0" } },
+    });
+    await finished;
+    socket.destroy();
+    if (res.statusCode !== 200)
+        throw new Error("could not restore a session");
+}
+/**
+ * The agent and key a request names in X-Message-CP-Agent and X-Message-CP-Agent-Key: undefined if it sends neither,
+ * null if it sends only one or either more than once. `headersDistinct` keeps a repeated header's values apart, where
+ * `headers` would join them into one.
+ */
+function agentHeaders(req) {
+    const name = req.headersDistinct["x-message-cp-agent"];
+    const key = req.headersDistinct["x-message-cp-agent-key"];
+    if (name === undefined && key === undefined)
+        return undefined;
+    if (name?.length !== 1 || key?.length !== 1)
+        return null;
+    return { name: name[0], key: key[0] };
+}
+/** Whether `identity` is the registration `agent` holds now; false for none. */
+const isAgent = (identity, agent) => identity !== undefined && identity.id === agent.id && identity.registeredAt === agent.registeredAt && identity.instance === agent.instance;
+/**
+ * Whether a request with `access` may act through a session registered as `identity` (undefined for none yet): a bound
+ * token only as its agent; a token that registers its own agents only as one it registered, or through a session not yet
+ * registered or whose registration was removed, which `Session.current()` treats as unregistered and where its
+ * `register` is checked; any other token as any agent of its account.
+ */
+const mayActAs = (db, access, identity) => {
+    if (access.agent)
+        return isAgent(identity, access.agent);
+    if (access.registers !== undefined) {
+        return identity === undefined || nameOfIdentity(db, access.account, identity) === undefined || registeredBy(db, access.account, identity, access.registers);
+    }
+    return true;
+};
+/** The account the request's bearer token belongs to, checked afresh on every request so a revoked token stops at once. */
+function accountOf(db, header, ownerToken) {
+    const m = /^bearer +(.*)$/i.exec(header ?? "");
+    // Hash something even without a header, so a refusal takes about as long either way.
+    const account = accountForToken(db, m?.[1] ?? "", ownerToken);
+    return m === null ? undefined : account;
+}
+function reply(res, status, message, headers = {}) {
+    res.writeHead(status, { "Content-Type": "application/json", ...headers });
+    res.end(JSON.stringify({ jsonrpc: "2.0", error: { code: -32000, message }, id: null }));
+}
+function sendJson(res, value) {
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify(value));
+}
+/**
+ * The `limit` and `offset` of a GET /api/* query, or undefined if either is bad. A key given twice is refused like a
+ * bad value, so no value supplied is silently ignored.
+ */
+function page(query, defaultLimit, maxLimit) {
+    const number = (key, fallback, min, max) => {
+        const values = query.getAll(key);
+        if (values.length === 0)
+            return fallback;
+        if (values.length > 1)
+            return undefined;
+        const raw = values[0];
+        const n = /^[0-9]+$/.test(raw) ? Number(raw) : NaN;
+        return Number.isSafeInteger(n) && n >= min && n <= max ? n : undefined;
+    };
+    const limit = number("limit", defaultLimit, 1, maxLimit);
+    const offset = number("offset", 0, 0, Number.MAX_SAFE_INTEGER);
+    return limit === undefined || offset === undefined ? undefined : { limit, offset };
+}
+/**
+ * Runs the database work of an /api/* request. A lock held past the busy timeout is transient, so it answers 503 with
+ * Retry-After rather than 500, and returns undefined; any other error is thrown.
+ */
+function unlessBusy(res, work) {
+    try {
+        return work();
+    }
+    catch (err) {
+        const code = err?.code;
+        if (typeof code !== "string" || !code.startsWith("SQLITE_BUSY"))
+            throw err;
+        reply(res, 503, "Database busy", { "Retry-After": "1" });
+        return undefined;
+    }
+}
+async function readText(req, maxBytes) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        size += chunk.length;
+        if (size > maxBytes)
+            throw new RangeError("body too large");
+        chunks.push(chunk);
+    }
+    return Buffer.concat(chunks).toString("utf8");
+}
+const readBody = async (req, maxBytes = MAX_BODY_BYTES) => JSON.parse(await readText(req, maxBytes));
+/** An OAuth error answer (RFC 6749 section 5.2), never cached. Its description never quotes the request. */
+function oauthError(res, status, error, description, headers = {}) {
+    res.writeHead(status, { "Content-Type": "application/json", "Cache-Control": "no-store", ...headers });
+    res.end(JSON.stringify({ error, error_description: description }));
+}
+function sendOAuthJson(res, status, value) {
+    res.writeHead(status, { "Content-Type": "application/json", "Cache-Control": "no-store" });
+    res.end(JSON.stringify(value));
+}
+/**
+ * What `serve --public-url` advertises for MCP's authorization flow: the protected resource metadata (RFC 9728) for
+ * /mcp, the authorization server metadata (RFC 8414), and the 401's WWW-Authenticate challenge pointing at the first.
+ * `publicUrl` is one `serve` checked with `publicUrl` in connect.ts.
+ */
+function oauthUrls(publicUrl) {
+    const base = new URL(publicUrl);
+    const prefix = base.pathname.replace(/\/+$/, "");
+    const at = (path) => {
+        const url = new URL(base.href);
+        // Set as the path, never resolved as a reference, so no path can change the host.
+        url.pathname = `${prefix}${path}`;
+        return url.href;
+    };
+    // The public URL, without the slash a URL with no path gets, as an issuer is usually written.
+    const issuer = prefix ? at("") : base.origin;
+    const resourceMetadata = at("/.well-known/oauth-protected-resource/mcp");
+    return {
+        resource: { resource: mcpEndpoint(publicUrl).href, authorization_servers: [issuer], bearer_methods_supported: ["header"] },
+        server: {
+            issuer,
+            authorization_endpoint: at("/oauth/authorize"),
+            token_endpoint: at("/oauth/token"),
+            registration_endpoint: at("/oauth/register"),
+            response_types_supported: ["code"],
+            grant_types_supported: ["authorization_code"],
+            code_challenge_methods_supported: ["S256"],
+            token_endpoint_auth_methods_supported: ["none"],
+            client_id_metadata_document_supported: true,
+        },
+        challenge: `Bearer resource_metadata="${resourceMetadata}"`,
+        // Where each metadata document is asked for: at the root, and, for a public URL with a path, with that path after
+        // the well-known part, as RFC 8414 and RFC 9728 build it from an issuer or resource with a path.
+        resourcePaths: new Set([
+            "/.well-known/oauth-protected-resource",
+            "/.well-known/oauth-protected-resource/mcp",
+            `/.well-known/oauth-protected-resource${prefix}/mcp`,
+        ]),
+        serverPaths: new Set(["/.well-known/oauth-authorization-server", `/.well-known/oauth-authorization-server${prefix}`]),
+        // The origin a browser names in Origin on a request from the approval page or the dashboard, and the path the
+        // sign-in cookie is sent under: the approval page's directory, /oauth/ under the public URL's path.
+        origin: base.origin,
+        cookiePath: `${prefix}/oauth/`,
+        // Whether the sign-in cookie is offered at all: only under an https public URL, so the cookie is always Secure. A
+        // browser sends a cookie to every port of its host, so over http one would also reach any other server on that host
+        // that the browser opens, such as a client's loopback redirect URI, with the token in it.
+        signin: base.protocol === "https:",
+    };
+}
+/** The cookie the approval page signs in with: the dashboard's token, set by POST /oauth/signin. */
+const SIGNIN_COOKIE = "message-cp-signin";
+/** The value of the sign-in cookie in `header`, or undefined for none or more than one. */
+function signinCookie(header) {
+    const values = (header ?? "")
+        .split(";")
+        .map((part) => part.trim())
+        .filter((part) => part.startsWith(`${SIGNIN_COOKIE}=`))
+        .map((part) => part.slice(SIGNIN_COOKIE.length + 1));
+    if (values.length !== 1)
+        return undefined;
+    try {
+        return decodeURIComponent(values[0]);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Whether `req` comes from a page of this server's own origin, as a browser says: Origin, which it sends on every
+ * POST and DELETE, equal to `origin`; or, without Origin (a same-origin GET), Sec-Fetch-Site "same-origin". A request
+ * with neither, as from a script outside a browser, is not.
+ */
+function sameOrigin(req, origin) {
+    const named = req.headersDistinct.origin;
+    if (named !== undefined)
+        return named.length === 1 && named[0] === origin;
+    const site = req.headersDistinct["sec-fetch-site"];
+    return site?.length === 1 && site[0] === "same-origin";
+}
+/**
+ * Serves the MCP tools over streamable HTTP at /mcp, one `Session` per MCP session. Every request needs the token,
+ * except GET / for the dashboard page, GET on each of the dashboard's font paths (`DASHBOARD_FONTS`), /health and, with
+ * a public URL, the authorization flow's metadata, registration, authorization page and token endpoint, and
+ * /oauth/signin and a token-less /oauth/approve, which use the sign-in cookie from this server's own origin instead.
+ */
+export async function startHttp(db, options) {
+    if (!options.token)
+        throw new Error("an HTTP token is required");
+    const idleTimeoutMs = options.idleTimeoutMs ?? DEFAULT_IDLE_TIMEOUT_MS;
+    if (!Number.isFinite(idleTimeoutMs) || idleTimeoutMs < 0)
+        throw new Error("idleTimeoutMs must be a finite number >= 0");
+    const maxSessions = options.maxSessions ?? DEFAULT_MAX_SESSIONS;
+    if (!Number.isInteger(maxSessions) || maxSessions < 1)
+        throw new Error("maxSessions must be a positive integer");
+    const waitHoldMs = options.waitHoldMs ?? DEFAULT_WAIT_HOLD_MS;
+    if (!Number.isFinite(waitHoldMs) || waitHoldMs < 0)
+        throw new Error("waitHoldMs must be a finite number >= 0");
+    const webhookIntervalMs = options.webhookIntervalMs ?? DEFAULT_WEBHOOK_INTERVAL_MS;
+    if (!Number.isFinite(webhookIntervalMs) || webhookIntervalMs < 10)
+        throw new Error("webhookIntervalMs must be a finite number >= 10");
+    const webhookOptions = sendOptions(options.webhookOptions ?? {});
+    const sessions = new Map();
+    let initializing = 0;
+    let waiting = 0;
+    // POST /mcp requests for an existing session whose body is being read, so a session cannot buffer bodies unbounded.
+    let reading = 0;
+    // POST /api/send, /api/post, /api/invites, /api/tokens and /api/webhooks, and POST and PATCH /api/people, requests
+    // between taking a slot and answering, so buffered bodies are bounded.
+    let actingAsPerson = 0;
+    // Held GET /wait requests per account and agent name (lower-cased, as names are unique regardless of case).
+    const held = new Map();
+    const holding = (account, name, delta) => {
+        const agents = held.get(account) ?? new Map();
+        const key = name.toLowerCase();
+        const n = (agents.get(key) ?? 0) + delta;
+        if (n > 0)
+            agents.set(key, n);
+        else
+            agents.delete(key);
+        if (agents.size > 0)
+            held.set(account, agents);
+        else
+            held.delete(account);
+    };
+    /**
+     * The lower-cased name of the agent `live` is currently registered as, or undefined if none. It never throws: a lock
+     * held past the busy timeout is `null`, to try again later; any other error logs one fixed line and counts as none.
+     */
+    const agentOf = (live) => {
+        try {
+            return live.session?.current()?.toLowerCase();
+        }
+        catch (err) {
+            if (isBusy(err))
+                return null;
+            console.error("message-cp serve: could not check a session's agent");
+            return undefined;
+        }
+    };
+    /** Whether `live`'s current agent has a GET /wait held, looked up under the session's own account only. */
+    const agentWaiting = (live) => {
+        const waits = held.get(live.account);
+        if (!waits)
+            return false;
+        const name = agentOf(live);
+        return name === null ? null : name !== undefined && waits.has(name);
+    };
+    /**
+     * Marks used now every session of `account` currently registered as `name`. It waits out the busy timeout once at
+     * most: after a busy write the rest are marked used here but not recorded, and a busy read ends the pass.
+     */
+    const touchSessionsOf = (account, name) => {
+        const key = name.toLowerCase();
+        const now = Date.now();
+        let busy = false;
+        for (const [id, live] of sessions) {
+            if (live.account !== account)
+                continue;
+            const agent = agentOf(live);
+            if (agent === null)
+                return;
+            if (agent !== key)
+                continue;
+            live.lastUsed = now;
+            if (!busy)
+                busy = !recordSession(() => touchSession(db, id, now));
+        }
+    };
+    const drop = (id) => {
+        const live = sessions.get(id);
+        if (!live)
+            return;
+        sessions.delete(id);
+        void live.transport.close().catch(() => { });
+    };
+    // Dropping a session in close() keeps its row, so the restart it is part of can restore it; the sweep forgets it.
+    // Ended rows are kept for a second idle timeout, which covers every server's live copy only while the servers sharing
+    // the database use the same timeout (`serve` always uses the default). Should one be swept early and recorded again,
+    // it can still only restore the registration that recorded it, and not once that is removed.
+    // A session whose agent has a GET /wait held counts as used now, so an agent stays registered while it waits. After the
+    // first busy result a pass does no more database work, so it waits out the busy timeout once at most: an idle session
+    // whose account has a wait held is kept for this pass, any other is dropped, and rows are forgotten on a later pass.
+    const sweep = setInterval(() => {
+        const now = Date.now();
+        const cutoff = now - idleTimeoutMs;
+        let busy = false;
+        for (const [id, live] of sessions) {
+            if (live.lastUsed >= cutoff)
+                continue;
+            const waiting = busy ? (held.has(live.account) ? null : false) : agentWaiting(live);
+            if (waiting === false)
+                drop(id);
+            else if (waiting === null)
+                busy = true;
+            else {
+                live.lastUsed = now;
+                if (!recordSession(() => touchSession(db, id, now)))
+                    busy = true;
+            }
+        }
+        if (!busy)
+            recordSession(() => forgetIdleSessions(db, cutoff, cutoff - idleTimeoutMs));
+    }, Math.max(10, Math.min(60_000, idleTimeoutMs / 2)));
+    sweep.unref();
+    // Webhook deliveries go out from here only: one pass at a time, each sending at most a batch, so outbound work is
+    // bounded. `close()` stops new claims and waits for the pass in progress.
+    const stopping = new AbortController();
+    let sending;
+    const deliver = setInterval(() => {
+        if (sending)
+            return;
+        sending = (async () => {
+            try {
+                await sendPending(db, { ...webhookOptions, signal: stopping.signal });
+            }
+            catch (err) {
+                // A lock held past the busy timeout is retried on the next pass; nothing about a delivery is logged.
+                const code = err?.code;
+                if (typeof code !== "string" || !code.startsWith("SQLITE_BUSY"))
+                    console.error("message-cp serve: webhook pass failed");
+            }
+            finally {
+                sending = undefined;
+            }
+        })();
+    }, webhookIntervalMs);
+    deliver.unref();
+    /**
+     * What each session's tools are given: `wait_for_mail` and `ask` holds count with waiting GET /wait requests against
+     * the same cap, and a hold ends once the response that would carry its answer has closed.
+     */
+    const serverOptions = (live) => ({
+        remote: true,
+        publicUrl: options.publicUrl,
+        hold: () => {
+            if (waiting >= maxSessions)
+                return undefined;
+            waiting++;
+            return () => void waiting--;
+        },
+        closed: (id) => live.open.get(id)?.signal,
+    });
+    /**
+     * One check for mail, for a name or for one registration; a lock held past the busy timeout counts as no mail this
+     * time, as in `message-cp wait`.
+     */
+    const poll = (account, reader) => {
+        try {
+            return unreadSummary(db, account, reader);
+        }
+        catch (err) {
+            const code = err?.code;
+            if (typeof code !== "string" || !code.startsWith("SQLITE_BUSY"))
+                throw err;
+            return { count: 0, senders: [], posts: 0, channels: [], mentions: 0, mentionChannels: [] };
+        }
+    };
+    /**
+     * Answers 200 with the unread summary as soon as the account's agent has mail or unread posts in a channel it has
+     * joined, 204 after `waitHoldMs` without any.
+     * Another account's agent is answered like an unknown one. A token bound to an agent waits only for that agent: for it
+     * when `agent` is left out, and as for an unknown agent when `agent` names another. Every poll of a bound wait reads
+     * the token's registration, not its name, so a hold whose agent is removed meanwhile answers 404 rather than another
+     * agent's mail under the same name. A token that registers its own agents waits only for one it registered, named by
+     * `agent`, and reads that agent's registration in the same way; any other name is answered as an unknown agent.
+     */
+    const wait = async (req, res, account, bound, registers) => {
+        if (req.method !== "GET")
+            return reply(res, 405, "Method not allowed", { Allow: "GET" });
+        const asked = new URL(req.url ?? "", "http://x").searchParams.get("agent");
+        if (bound && asked && asked.toLowerCase() !== bound.name.toLowerCase())
+            return reply(res, 404, "No such agent");
+        let own;
+        if (registers !== undefined && asked) {
+            const found = unlessBusy(res, () => ownAgentOf(db, account, asked, registers) ?? null);
+            if (found === undefined)
+                return;
+            if (found === null)
+                return reply(res, 404, "No such agent");
+            own = found;
+        }
+        if (registers !== undefined && !own)
+            return reply(res, 404, "No such agent");
+        const name = bound ? bound.name : own ? own.name : asked;
+        const reader = bound ?? (own ? { id: own.id, registeredAt: own.registeredAt, instance: own.instance } : asked);
+        const first = reader ? poll(account, reader) : undefined;
+        if (!first)
+            return reply(res, 404, "No such agent");
+        // Mail that is already there is answered at once, whatever the cap.
+        if (hasUnread(first)) {
+            res.writeHead(200, { "Content-Type": "text/plain" });
+            return void res.end(`${formatUnread(first)}\n`);
+        }
+        // Held requests are capped like sessions, so a runaway client cannot pin the server's connections.
+        if (waiting >= maxSessions)
+            return reply(res, 503, "Too many waiting requests", { "Retry-After": "5" });
+        waiting++;
+        holding(account, name, 1);
+        let gone = false;
+        let wake = () => { };
+        res.on("close", () => {
+            gone = true;
+            wake();
+        });
+        const deadline = Date.now() + waitHoldMs;
+        try {
+            await hold(first, account, reader, deadline, res, () => gone, (w) => (wake = w));
+        }
+        finally {
+            waiting--;
+            holding(account, name, -1);
+            // The agent's sessions count as used as the hold ends, so the gap before the wait loop asks again cannot drop them.
+            touchSessionsOf(account, name);
+        }
+    };
+    const hold = async (first, account, reader, deadline, res, isGone, setWake) => {
+        for (let unread = first;; unread = poll(account, reader)) {
+            if (isGone())
+                return;
+            if (!unread)
+                return reply(res, 404, "No such agent");
+            if (hasUnread(unread)) {
+                res.writeHead(200, { "Content-Type": "text/plain" });
+                return void res.end(`${formatUnread(unread)}\n`);
+            }
+            const left = deadline - Date.now();
+            if (left <= 0) {
+                res.writeHead(204);
+                return void res.end();
+            }
+            // A held check that found nothing marks the agent waiting, as `wait_for_mail` does.
+            markWaiting(db, account, reader);
+            // Sleep a second, or until the client goes away; the timer is cleared either way.
+            await new Promise((resolve) => {
+                const timer = setTimeout(resolve, Math.min(1000, left));
+                setWake(() => {
+                    clearTimeout(timer);
+                    resolve();
+                });
+            });
+        }
+    };
+    /**
+     * GET /api/token: whether the request's token is read-only and whether it is agent-only, so the dashboard tells an
+     * agent token that it cannot use the page, and for a person token the person's name, which the dashboard then posts
+     * and sends as (the server still refuses any other), and `admin: true` while that person is an admin, so the
+     * dashboard offers Delete. A full token is neither and has no person: the dashboard offers it Delete but no posting,
+     * which the server refuses it. It gives nothing else about the token: no token, hash, id or account.
+     */
+    const apiToken = (req, res, access) => {
+        if (req.method !== "GET")
+            return reply(res, 405, "Method not allowed", { Allow: "GET" });
+        sendJson(res, {
+            readOnly: access.readOnly,
+            agentOnly: access.agentOnly,
+            ...(access.person && { person: access.person.name }),
+            ...(access.person?.admin && { admin: true }),
+        });
+    };
+    /**
+     * GET /api/agents: one page of the account's live agents, as `list_agents` pages them, each with its unread message,
+     * post and mention counts, its status line while current (null otherwise) and whether it is online. Counts only,
+     * never a message or post; it reads nothing as read.
+     */
+    const apiAgents = (req, res, account) => {
+        if (req.method !== "GET")
+            return reply(res, 405, "Method not allowed", { Allow: "GET, DELETE" });
+        const query = new URL(req.url ?? "", "http://x").searchParams;
+        const paging = page(query, DEFAULT_LIST_LIMIT, MAX_LIST_LIMIT);
+        if (paging === undefined)
+            return reply(res, 400, `limit must be 1-${MAX_LIST_LIMIT} and offset 0 or more`);
+        const waits = held.get(account);
+        const recent = Date.now() - ONLINE_WINDOW_MS;
+        // One query, so the page and its counts describe the same moment.
+        const agents = unlessBusy(res, () => listAgentsUnread(db, account, paging.limit, paging.offset));
+        if (agents === undefined)
+            return;
+        sendJson(res, agents.map((a) => ({
+            ...a,
+            // A person is never online: their lastSeen is when they were added, and they do not wait.
+            online: !a.person && ((waits?.get(a.name.toLowerCase()) ?? 0) > 0 || Date.parse(a.lastSeen) >= recent),
+        })));
+    };
+    /**
+     * GET /api/channels: one page of the account's channels by name, each with its post count, last post time and the
+     * names of the live agents that have joined it. No post bodies; it marks nothing read.
+     */
+    const apiChannels = (req, res, account) => {
+        if (req.method !== "GET")
+            return reply(res, 405, "Method not allowed", { Allow: "GET" });
+        const query = new URL(req.url ?? "", "http://x").searchParams;
+        const paging = page(query, DEFAULT_CHANNEL_LIMIT, MAX_CHANNEL_LIMIT);
+        if (paging === undefined)
+            return reply(res, 400, `limit must be 1-${MAX_CHANNEL_LIMIT} and offset 0 or more`);
+        const channels = unlessBusy(res, () => listAccountChannels(db, account, paging.limit, paging.offset));
+        if (channels === undefined)
+            return;
+        sendJson(res, channels);
+    };
+    /**
+     * GET /api/channel-posts?channel=<name>: one page of the account's channel, oldest first, each post with whether each
+     * agent of the account it mentions has read the mention. `?unread=true` answers only the posts with at least one
+     * unread mention of an agent. It moves no agent's read position and marks nothing read. A channel only another account
+     * has is answered like one that does not exist.
+     */
+    const apiChannelPosts = (req, res, account) => {
+        if (req.method !== "GET")
+            return reply(res, 405, "Method not allowed", { Allow: "GET" });
+        const query = new URL(req.url ?? "", "http://x").searchParams;
+        const names = query.getAll("channel");
+        if (names.length !== 1)
+            return reply(res, 404, "No such channel");
+        const paging = page(query, DEFAULT_CHANNEL_LIMIT, MAX_CHANNEL_LIMIT);
+        if (paging === undefined)
+            return reply(res, 400, `limit must be 1-${MAX_CHANNEL_LIMIT} and offset 0 or more`);
+        const unread = query.getAll("unread");
+        if (unread.length > 1 || (unread.length === 1 && unread[0] !== "true"))
+            return reply(res, 400, "unread must be true");
+        const unreadOnly = unread.length === 1;
+        let channel;
+        try {
+            channel = unlessBusy(res, () => readAccountChannel(db, account, names[0], paging.limit, paging.offset, unreadOnly));
+        }
+        catch (err) {
+            // An invalid name and a missing channel are the same answer, so neither says more than the other.
+            if (err instanceof ToolError)
+                return reply(res, 404, "No such channel");
+            throw err;
+        }
+        if (channel === undefined)
+            return;
+        sendJson(res, channel);
+    };
+    /**
+     * GET /api/messages: one page of the account's direct messages, oldest first, each with its recipient, whether it
+     * has been read, and `starting`: whether it is to an agent that has not read it and a webhook delivered it.
+     * `?unread=true` answers only the messages to an agent, not to a person, whose recipient has not read them. It marks
+     * nothing read, so no unread count, `lastSeen` or /wait answer moves.
+     */
+    const apiMessages = (req, res, account) => {
+        if (req.method !== "GET")
+            return reply(res, 405, "Method not allowed", { Allow: "GET" });
+        const query = new URL(req.url ?? "", "http://x").searchParams;
+        const paging = page(query, DEFAULT_INBOX_LIMIT, MAX_INBOX_LIMIT);
+        if (paging === undefined)
+            return reply(res, 400, `limit must be 1-${MAX_INBOX_LIMIT} and offset 0 or more`);
+        const unread = query.getAll("unread");
+        if (unread.length > 1 || (unread.length === 1 && unread[0] !== "true"))
+            return reply(res, 400, "unread must be true");
+        const unreadOnly = unread.length === 1;
+        const messages = unlessBusy(res, () => listAccountMessages(db, account, paging.limit, paging.offset, unreadOnly));
+        if (messages === undefined)
+            return;
+        sendJson(res, messages);
+    };
+    /**
+     * DELETE /api/conversation?a=<name>&b=<name>: deletes the account's direct messages between a and b, either way, and
+     * answers how many. Reads no body and holds nothing open, so it takes no slot.
+     */
+    const apiConversation = (req, res, account) => {
+        if (req.method !== "DELETE")
+            return reply(res, 405, "Method not allowed", { Allow: "DELETE" });
+        const query = new URL(req.url ?? "", "http://x").searchParams;
+        const [a, b] = [query.getAll("a"), query.getAll("b")];
+        if (a.length !== 1 || b.length !== 1 || a[0] === "" || b[0] === "")
+            return reply(res, 400, "Give a and b once each");
+        const deleted = unlessBusy(res, () => deleteConversation(db, account, a[0], b[0]));
+        if (deleted === undefined)
+            return;
+        sendJson(res, { deleted });
+    };
+    /**
+     * GET /api/webhook-deliveries: one page of the deliveries for the account's webhooks, newest first, each with its
+     * status under this server's `maxAttempts`. Never a webhook's URL or secret, or a message or post body.
+     */
+    const apiWebhookDeliveries = (req, res, account) => {
+        if (req.method !== "GET")
+            return reply(res, 405, "Method not allowed", { Allow: "GET" });
+        const query = new URL(req.url ?? "", "http://x").searchParams;
+        const paging = page(query, DEFAULT_INBOX_LIMIT, MAX_INBOX_LIMIT);
+        if (paging === undefined)
+            return reply(res, 400, `limit must be 1-${MAX_INBOX_LIMIT} and offset 0 or more`);
+        const deliveries = unlessBusy(res, () => listAccountDeliveries(db, account, webhookOptions.maxAttempts, paging.limit, paging.offset));
+        if (deliveries === undefined)
+            return;
+        sendJson(res, deliveries);
+    };
+    /**
+     * GET /api/approvals: one page of the account's unrevoked tokens the OAuth code exchange issued, newest first, each with
+     * its id, whether it registers its own agents, its agent's name (null for one that registers), for one that registers
+     * the names of the live agents it registered (empty for none), the client's name and metadata host (each null for
+     * none) and when it was issued. A single-agent token whose agent was removed is left out. Never a token, hash, code or
+     * redirect URI. DELETE is routed to `apiRevokeApproval` before this, so any method but GET is answered 405 here.
+     */
+    const apiApprovals = (req, res, account) => {
+        if (req.method !== "GET")
+            return reply(res, 405, "Method not allowed", { Allow: "GET, DELETE" });
+        const query = new URL(req.url ?? "", "http://x").searchParams;
+        const paging = page(query, DEFAULT_LIST_LIMIT, MAX_LIST_LIMIT);
+        if (paging === undefined)
+            return reply(res, 400, `limit must be 1-${MAX_LIST_LIMIT} and offset 0 or more`);
+        const approvals = unlessBusy(res, () => listApprovals(db, account, paging.limit, paging.offset));
+        if (approvals === undefined)
+            return;
+        sendJson(res, approvals);
+    };
+    /**
+     * GET /api/search?text=<text>: one page of the account's messages and channel posts whose body contains `text`,
+     * newest first, with the `search` tool's filters and errors. It marks nothing read and moves no read position.
+     */
+    const apiSearch = (req, res, account) => {
+        if (req.method !== "GET")
+            return reply(res, 405, "Method not allowed", { Allow: "GET" });
+        const query = new URL(req.url ?? "", "http://x").searchParams;
+        const texts = query.getAll("text");
+        if (texts.length !== 1)
+            return reply(res, 400, "Give text once");
+        const filters = {};
+        for (const key of ["channel", "from", "since", "until"]) {
+            const values = query.getAll(key);
+            if (values.length > 1)
+                return reply(res, 400, `Give ${key} at most once`);
+            if (values.length === 1)
+                filters[key] = values[0];
+        }
+        const paging = page(query, DEFAULT_INBOX_LIMIT, MAX_INBOX_LIMIT);
+        if (paging === undefined)
+            return reply(res, 400, `limit must be 1-${MAX_INBOX_LIMIT} and offset 0 or more`);
+        let found;
+        try {
+            found = unlessBusy(res, () => searchAccount(db, account, texts[0], filters, paging.limit, paging.offset));
+        }
+        catch (err) {
+            if (err instanceof ToolError)
+                return reply(res, 400, err.message);
+            throw err;
+        }
+        if (found === undefined)
+            return;
+        sendJson(res, found);
+    };
+    /**
+     * POST /api/send and /api/post: reads a JSON object whose `fields` are all strings and answers with what `act` returns
+     * for it. A slot is taken before the body is read and given back at the end, so held bodies are capped like sessions.
+     * Only a person token reaches it, and an `as` that is not the token's own live person, an unknown or removed name
+     * included, gets 403; `act` answers undefined, which gets 404, only when given no person to match, which no route does.
+     * A tool's refusal gets 400 with its message, which never quotes the body.
+     */
+    const asPerson = async (req, res, fields, act) => {
+        if (req.method !== "POST")
+            return reply(res, 405, "Method not allowed", { Allow: "POST" });
+        if (actingAsPerson >= maxSessions)
+            return reply(res, 503, "Too many requests", { Connection: "close" });
+        actingAsPerson++;
+        try {
+            let input;
+            try {
+                input = await readBody(req, MAX_PERSON_BODY_BYTES);
+            }
+            catch (err) {
+                return err instanceof RangeError ? reply(res, 413, "Request body too large") : reply(res, 400, "Invalid JSON");
+            }
+            // Anything but an object with each field a string, an array or `null` included, has some field missing.
+            if (fields.some((f) => typeof input?.[f] !== "string")) {
+                return reply(res, 400, `Give ${fields.join(", ")} as strings`);
+            }
+            let done;
+            try {
+                // null for no such person, kept apart from the undefined `unlessBusy` gives once it has answered 503.
+                done = unlessBusy(res, () => act(input) ?? null);
+            }
+            catch (err) {
+                if (err instanceof WrongPersonError)
+                    return reply(res, 403, err.message);
+                if (err instanceof ToolError)
+                    return reply(res, 400, err.message);
+                throw err;
+            }
+            if (done === undefined)
+                return;
+            if (done === null)
+                return reply(res, 404, "No such person");
+            sendJson(res, done);
+        }
+        finally {
+            actingAsPerson--;
+        }
+    };
+    /**
+     * POST /api/send: `{ as, to, body }`, sent as `send_message` sends it, from the account's person `as`, who must be
+     * `only`, the person token's person.
+     */
+    const apiSend = (req, res, account, only) => asPerson(req, res, ["as", "to", "body"], (m) => {
+        // The stored ids are send_message's alone: this answer stays `{ delivered, recipients }`.
+        const sent = sendAsPerson(db, account, m.as, m.to, m.body, only);
+        return sent && { delivered: sent.delivered, recipients: sent.recipients };
+    });
+    /** POST /api/post: `{ as, channel, body }`, posted as `post` posts it, by the account's person `as`; as `apiSend` limits it. */
+    const apiPost = (req, res, account, only) => asPerson(req, res, ["as", "channel", "body"], (m) => postAsPerson(db, account, m.as, m.channel, m.body, only));
+    /** An invite as POST /api/people and /api/invites answer it: with its link only when `serve` has a public URL. */
+    const inviteJson = (invite) => ({
+        id: invite.id,
+        code: invite.code,
+        expiresAt: new Date(invite.expiresAt).toISOString(),
+        ...(options.publicUrl !== undefined && { link: loginLink(dashboardUrl(options.publicUrl), invite.code).href }),
+    });
+    /**
+     * POST and PATCH /api/people and POST /api/invites, /api/tokens and /api/webhooks: reads a JSON object and answers
+     * with what `act` makes of it, never cached, as it may carry an invite's code, a new token or a webhook's secret. A
+     * slot is taken before the body is read and given back at the end, sharing
+     * `asPerson`'s count. `act` answers a string for 400, undefined for 404, and throws `PersonError` for 400, `LoginError`
+     * for 503, `OwnPersonError` for 403 and `NotAdminError`, for a token's person removed or unmarked while the body was
+     * read, for 403.
+     */
+    const asAdmin = async (req, res, act) => {
+        if (actingAsPerson >= maxSessions)
+            return reply(res, 503, "Too many requests", { Connection: "close" });
+        actingAsPerson++;
+        try {
+            let input;
+            try {
+                input = await readBody(req, MAX_PERSON_BODY_BYTES);
+            }
+            catch (err) {
+                return err instanceof RangeError ? reply(res, 413, "Request body too large") : reply(res, 400, "Invalid JSON");
+            }
+            let done;
+            try {
+                // null for no such person, kept apart from the undefined `unlessBusy` gives once it has answered 503.
+                done = unlessBusy(res, () => act(typeof input === "object" && input !== null ? input : {}) ?? null);
+            }
+            catch (err) {
+                if (err instanceof PersonError)
+                    return reply(res, 400, err.message);
+                if (err instanceof NotAdminError || err instanceof OwnPersonError)
+                    return reply(res, 403, err.message);
+                if (err instanceof LoginError)
+                    return reply(res, 503, err.message);
+                throw err;
+            }
+            if (done === undefined)
+                return;
+            if (done === null)
+                return reply(res, 404, "No such person");
+            if (typeof done === "string")
+                return reply(res, 400, done);
+            sendOAuthJson(res, 200, done);
+        }
+        finally {
+            actingAsPerson--;
+        }
+    };
+    /**
+     * /api/people. GET: one page of the account's live people by name, each `{ name, admin, addedAt }`; it reads no body
+     * and takes no slot. POST `{ name, admin }`: adds the person `name`, an admin with `admin` true, to the account and makes
+     * their first invite, as `addInvitedPerson` does. Answers `{ name, admin, invite: { id, code, expiresAt, link? } }`.
+     * PATCH `?name=<name>` with `{ admin }`: marks the account's live person `name` (any case) an admin, or unmarks them
+     * with `admin` false, as `setAdminBy` does, answering `{ name, admin }`. DELETE `?name=<name>`: removes them as
+     * `removePersonBy` does, answering `{ name, messages, mentions, tokens, signins }`: the counts deleted, and how many of
+     * their tokens and dashboard sign-ins stopped working, though none is revoked or deleted. Both answer 404 for a name no
+     * live person of the account has, another account's included, and 403 to the token's own person unmarking or removing
+     * themselves. DELETE reads no body and takes no slot.
+     */
+    const apiPeople = (req, res, account, by) => {
+        if (req.method === "POST") {
+            return asAdmin(req, res, (input) => {
+                if (typeof input.name !== "string" || typeof input.admin !== "boolean")
+                    return "Give name as a string and admin as true or false";
+                const added = addInvitedPerson(db, account, by, input.name, input.admin);
+                return { name: added.name, admin: added.admin, invite: inviteJson(added.invite) };
+            });
+        }
+        const query = new URL(req.url ?? "", "http://x").searchParams;
+        if (req.method === "GET") {
+            const paging = page(query, DEFAULT_LIST_LIMIT, MAX_LIST_LIMIT);
+            if (paging === undefined)
+                return reply(res, 400, `limit must be 1-${MAX_LIST_LIMIT} and offset 0 or more`);
+            const people = unlessBusy(res, () => listAccountPeople(db, account, paging.limit, paging.offset));
+            if (people === undefined)
+                return;
+            return sendJson(res, people);
+        }
+        if (req.method !== "PATCH" && req.method !== "DELETE")
+            return reply(res, 405, "Method not allowed", { Allow: "GET, POST, PATCH, DELETE" });
+        const names = query.getAll("name");
+        // A PATCH's body is left unread, so its 400 closes the connection.
+        if (names.length !== 1 || names[0] === "")
+            return reply(res, 400, "Give name once", req.method === "PATCH" ? { Connection: "close" } : {});
+        const name = names[0];
+        if (req.method === "PATCH") {
+            return asAdmin(req, res, (input) => {
+                if (typeof input.admin !== "boolean")
+                    return "Give admin as true or false";
+                return setAdminBy(db, account, by, name, input.admin);
+            });
+        }
+        let removed;
+        try {
+            // null for no such person, kept apart from the undefined `unlessBusy` gives once it has answered 503.
+            removed = unlessBusy(res, () => removePersonBy(db, account, by, name) ?? null);
+        }
+        catch (err) {
+            if (err instanceof NotAdminError || err instanceof OwnPersonError)
+                return reply(res, 403, err.message);
+            throw err;
+        }
+        if (removed === undefined)
+            return;
+        if (removed === null)
+            return reply(res, 404, "No such person");
+        return sendJson(res, {
+            name: removed.name,
+            messages: removed.messages,
+            mentions: removed.mentions,
+            tokens: removed.tokens,
+            signins: removed.signins,
+        });
+    };
+    /**
+     * /api/invites. POST `{ person }`: a new invite for the account's live person `person` (any case), answered as POST
+     * /api/people answers, or 404 for any other name. GET: one page of the account's invites not used, cancelled or
+     * expired, newest first, never a code. DELETE `?id=<id>`: cancels the account's invite `id` while it is not used,
+     * cancelled or expired, else 404, the same for another account's. GET and DELETE read no body and take no slot.
+     */
+    const apiInvites = (req, res, account, by) => {
+        const query = new URL(req.url ?? "", "http://x").searchParams;
+        if (req.method === "POST") {
+            return asAdmin(req, res, (input) => {
+                if (typeof input.person !== "string")
+                    return "Give person as a string";
+                const made = makeInvite(db, account, by, input.person);
+                return made && { name: made.name, admin: made.admin, invite: inviteJson(made.invite) };
+            });
+        }
+        if (req.method === "GET") {
+            const paging = page(query, DEFAULT_LIST_LIMIT, MAX_LIST_LIMIT);
+            if (paging === undefined)
+                return reply(res, 400, `limit must be 1-${MAX_LIST_LIMIT} and offset 0 or more`);
+            const invites = unlessBusy(res, () => listInvites(db, account, paging.limit, paging.offset));
+            if (invites === undefined)
+                return;
+            return sendJson(res, invites);
+        }
+        if (req.method === "DELETE") {
+            const ids = query.getAll("id");
+            if (ids.length !== 1)
+                return reply(res, 400, "Give id once");
+            const id = /^[1-9][0-9]{0,15}$/.test(ids[0]) ? Number(ids[0]) : NaN;
+            const cancelled = Number.isSafeInteger(id) ? unlessBusy(res, () => cancelInvite(db, account, id)) : false;
+            if (cancelled === undefined)
+                return;
+            if (!cancelled)
+                return reply(res, 404, "No such invite");
+            return sendJson(res, { cancelled: true });
+        }
+        return reply(res, 405, "Method not allowed", { Allow: "GET, POST, DELETE" });
+    };
+    /**
+     * DELETE /api/agents?name=<name> and POST /api/agents/key?name=<name>: the agent named in the query, which neither reads
+     * a body, so neither takes a slot. `act` answers undefined for 404, and throws `NotAdminError`, for a token's person
+     * removed or unmarked since the token was checked, for 403.
+     */
+    const asAdminOnAgent = (req, res, act, answer) => {
+        const names = new URL(req.url ?? "", "http://x").searchParams.getAll("name");
+        if (names.length !== 1 || names[0] === "")
+            return reply(res, 400, "Give name once");
+        let done;
+        try {
+            // null for no such agent, kept apart from the undefined `unlessBusy` gives once it has answered 503.
+            done = unlessBusy(res, () => act(names[0]) ?? null);
+        }
+        catch (err) {
+            if (err instanceof NotAdminError)
+                return reply(res, 403, err.message);
+            throw err;
+        }
+        if (done === undefined)
+            return;
+        if (done === null)
+            return reply(res, 404, "No such agent");
+        answer(res, done);
+    };
+    /**
+     * DELETE /api/agents?name=<name>: removes the account's agent `name` (any case), live or only left as removed rows,
+     * with its direct messages and mentions, as `removeAgentBy` does. Answers `{ name, messages, mentions, tokens }`, the
+     * counts deleted and the live agent's tokens that stopped working, or 404 for a name no agent of the account has had,
+     * a person's or another account's agent's included.
+     */
+    const apiRemoveAgent = (req, res, account, by) => asAdminOnAgent(req, res, (name) => removeAgentBy(db, account, by, name), sendJson);
+    /**
+     * POST /api/agents/key?name=<name>: gives the account's live agent `name` (any case) a new key, ending its sessions,
+     * as `resetAgentKeyBy` does. Answers `{ name, key }`, never cached, as it carries the key, or 404 for a name no
+     * live agent of the account has, a person's or another account's agent's included.
+     */
+    const apiAgentKey = (req, res, account, by) => {
+        if (req.method !== "POST")
+            return reply(res, 405, "Method not allowed", { Allow: "POST" });
+        return asAdminOnAgent(req, res, (name) => resetAgentKeyBy(db, account, by, name), (r, value) => sendOAuthJson(r, 200, value));
+    };
+    /**
+     * /api/webhooks. GET: one page of the account's webhooks, oldest first, as `listWebhooksBy` gives them: each URL's
+     * origin only, never a secret, header value or fixed body. POST `{ url, on, includeText?, header?, maxPerHour?, body? }`:
+     * adds a webhook to the account as `addWebhookBy` does, answering it as GET lists it plus its secret, shown this once
+     * and never cached, or 400 with `addWebhook`'s refusal, which never repeats the URL or header value. It takes a slot
+     * through `asAdmin`. DELETE `?id=<id>`: removes the account's webhook `id` with its deliveries, as `removeWebhookBy`
+     * does, answering `{ id, deliveries }`, or 404 for an id the account has no webhook with, another account's included.
+     * GET and DELETE read no body, so neither takes a slot. `NotAdminError`, for a token's person removed or unmarked
+     * since the token was checked, answers 403.
+     */
+    const apiWebhooks = (req, res, account, by) => {
+        if (req.method === "POST") {
+            return asAdmin(req, res, (input) => {
+                // asAdmin gives anything but an object as {}, which has no url; an array is an object with index keys.
+                if (Array.isArray(input) || Object.keys(input).some((k) => !WEBHOOK_FIELDS.includes(k))) {
+                    return `Give a JSON object with only ${WEBHOOK_FIELDS.join(", ")}`;
+                }
+                const { url, on, includeText = true, header, maxPerHour, body } = input;
+                if (typeof url !== "string" ||
+                    typeof on !== "string" ||
+                    typeof includeText !== "boolean" ||
+                    (header !== undefined && typeof header !== "string") ||
+                    (maxPerHour !== undefined && typeof maxPerHour !== "number") ||
+                    (body !== undefined && typeof body !== "string")) {
+                    return "Give url and on as strings, and optionally includeText as true or false, header and body as strings and maxPerHour as a number";
+                }
+                try {
+                    return addWebhookBy(db, account, by, { url, on, includeText, header, maxPerHour, body });
+                }
+                catch (err) {
+                    // Its messages never repeat the URL, header value or body.
+                    if (err instanceof WebhookError)
+                        return err.message;
+                    throw err;
+                }
+            });
+        }
+        const query = new URL(req.url ?? "", "http://x").searchParams;
+        let work;
+        if (req.method === "GET") {
+            const paging = page(query, DEFAULT_LIST_LIMIT, MAX_LIST_LIMIT);
+            if (paging === undefined)
+                return reply(res, 400, `limit must be 1-${MAX_LIST_LIMIT} and offset 0 or more`);
+            work = () => listWebhooksBy(db, account, by, paging.limit, paging.offset);
+        }
+        else if (req.method === "DELETE") {
+            const ids = query.getAll("id");
+            if (ids.length !== 1)
+                return reply(res, 400, "Give id once");
+            const id = /^[0-9]{1,16}$/.test(ids[0]) ? Number(ids[0]) : NaN;
+            if (!Number.isSafeInteger(id))
+                return reply(res, 400, "Give id as a whole number");
+            work = () => removeWebhookBy(db, account, by, id);
+        }
+        else {
+            return reply(res, 405, "Method not allowed", { Allow: "GET, POST, DELETE" });
+        }
+        let done;
+        try {
+            // null for no such webhook, kept apart from the undefined `unlessBusy` gives once it has answered 503.
+            done = unlessBusy(res, () => work() ?? null);
+        }
+        catch (err) {
+            if (err instanceof NotAdminError)
+                return reply(res, 403, err.message);
+            throw err;
+        }
+        if (done === undefined)
+            return;
+        if (done === null)
+            return reply(res, 404, "No such webhook");
+        sendJson(res, done);
+    };
+    /**
+     * DELETE /api/approvals?id=<id>: revokes the account's approval `id`, as `revokeApprovalBy` does, answering `{ id,
+     * agents }`, with `agents` the names of the agents the revoke ended (empty for none), or 404 for an id that is no
+     * unrevoked OAuth token of the account, another account's included. It reads no body, so it takes no slot.
+     * `NotAdminError`, for a token's person removed or unmarked since the token was checked, answers 403.
+     */
+    const apiRevokeApproval = (req, res, account, by) => {
+        const ids = new URL(req.url ?? "", "http://x").searchParams.getAll("id");
+        if (ids.length !== 1)
+            return reply(res, 400, "Give id once");
+        const id = /^[0-9]{1,16}$/.test(ids[0]) ? Number(ids[0]) : NaN;
+        if (!Number.isSafeInteger(id))
+            return reply(res, 400, "Give id as a whole number");
+        let done;
+        try {
+            // null for no such approval, kept apart from the undefined `unlessBusy` gives once it has answered 503.
+            done = unlessBusy(res, () => revokeApprovalBy(db, account, by, id) ?? null);
+        }
+        catch (err) {
+            if (err instanceof NotAdminError)
+                return reply(res, 403, err.message);
+            throw err;
+        }
+        if (done === undefined)
+            return;
+        if (done === null)
+            return reply(res, 404, "No such approval");
+        sendJson(res, done);
+    };
+    /**
+     * /api/tokens. GET: one page of the account's unrevoked tokens, oldest first, as `listTokensBy` gives them, each with
+     * `lastUsedAt`, when a request last used it to within a minute (earlier if a write was skipped or failed), or null
+     * until a request is recorded: never a token or its hash. POST `{ kind }`, with kind "read-only" or "agent" and no
+     * other field: makes a new unbound token of that kind for the account, as `addTokenBy` does, answering `{ id, kind, token }`, never cached; the raw token is in
+     * that answer only. Any other body answers 400, or 413 past 64 KB, and makes nothing. DELETE `?id=<id>`: revokes the account's token `id`
+     * of any kind, as `revokeTokenBy` does, the token this request carries included, answering `{ id, signins, agents }`, with `signins`
+     * the number of the token's dashboard sign-ins that this revoke ended (0 for none) and `agents` the names of the agents
+     * it ended (empty for none), or 404 for an id
+     * that is no unrevoked token of the account, another account's included. A request already running on a revoked
+     * token may finish; its next request gets 401. GET and DELETE read no body and take no slot; POST takes `asAdmin`'s.
+     * `NotAdminError`, for a token's person removed or unmarked since the token was checked, answers 403.
+     */
+    const apiTokens = (req, res, account, by) => {
+        if (req.method === "POST") {
+            return asAdmin(req, res, (input) => {
+                const keys = Object.keys(input);
+                if (keys.length !== 1 || keys[0] !== "kind" || (input.kind !== "read-only" && input.kind !== "agent")) {
+                    return 'Give only kind, as "read-only" or "agent"';
+                }
+                return addTokenBy(db, account, by, input.kind);
+            });
+        }
+        const query = new URL(req.url ?? "", "http://x").searchParams;
+        let work;
+        if (req.method === "GET") {
+            const paging = page(query, DEFAULT_LIST_LIMIT, MAX_LIST_LIMIT);
+            if (paging === undefined)
+                return reply(res, 400, `limit must be 1-${MAX_LIST_LIMIT} and offset 0 or more`);
+            work = () => listTokensBy(db, account, by, paging.limit, paging.offset);
+        }
+        else if (req.method === "DELETE") {
+            const ids = query.getAll("id");
+            if (ids.length !== 1)
+                return reply(res, 400, "Give id once");
+            const id = /^[0-9]{1,16}$/.test(ids[0]) ? Number(ids[0]) : NaN;
+            if (!Number.isSafeInteger(id))
+                return reply(res, 400, "Give id as a whole number");
+            work = () => revokeTokenBy(db, account, by, id);
+        }
+        else {
+            return reply(res, 405, "Method not allowed", { Allow: "GET, POST, DELETE" });
+        }
+        let done;
+        try {
+            // null for no such token, kept apart from the undefined `unlessBusy` gives once it has answered 503.
+            done = unlessBusy(res, () => work() ?? null);
+        }
+        catch (err) {
+            if (err instanceof NotAdminError)
+                return reply(res, 403, err.message);
+            throw err;
+        }
+        if (done === undefined)
+            return;
+        if (done === null)
+            return reply(res, 404, "No such token");
+        sendJson(res, done);
+    };
+    /**
+     * /api/signins. GET: one page of the account's live dashboard sign-ins, oldest first, as `listSigninsBy` gives them,
+     * with `current` on the request's own (`current`, its `access.session`): never a session id, its hash or a token.
+     * DELETE `?id=<id>`: ends the account's sign-in `id`, as `endSigninBy` does, the request's own included, answering
+     * `{ id }`, or 404 for an id that is no live sign-in of the account, another account's included. A request already
+     * running on an ended sign-in may finish; its next request gets 401. Neither reads a body, so neither takes a slot.
+     * `NotAdminError`, for a token's person removed or unmarked since the token was checked, answers 403.
+     */
+    const apiSignins = (req, res, account, by, current) => {
+        const query = new URL(req.url ?? "", "http://x").searchParams;
+        let work;
+        if (req.method === "GET") {
+            const paging = page(query, DEFAULT_LIST_LIMIT, MAX_LIST_LIMIT);
+            if (paging === undefined)
+                return reply(res, 400, `limit must be 1-${MAX_LIST_LIMIT} and offset 0 or more`);
+            work = () => listSigninsBy(db, account, by, current, paging.limit, paging.offset);
+        }
+        else if (req.method === "DELETE") {
+            const ids = query.getAll("id");
+            if (ids.length !== 1)
+                return reply(res, 400, "Give id once");
+            const id = /^[0-9]{1,16}$/.test(ids[0]) ? Number(ids[0]) : NaN;
+            if (!Number.isSafeInteger(id))
+                return reply(res, 400, "Give id as a whole number");
+            work = () => endSigninBy(db, account, by, id);
+        }
+        else {
+            return reply(res, 405, "Method not allowed", { Allow: "GET, DELETE" });
+        }
+        let done;
+        try {
+            // null for no such sign-in, kept apart from the undefined `unlessBusy` gives once it has answered 503.
+            done = unlessBusy(res, () => work() ?? null);
+        }
+        catch (err) {
+            if (err instanceof NotAdminError)
+                return reply(res, 403, err.message);
+            throw err;
+        }
+        if (done === undefined)
+            return;
+        if (done === null)
+            return reply(res, 404, "No such sign-in");
+        sendJson(res, done);
+    };
+    // MCP's authorization flow, served only with a public URL, from which every address it advertises is built: as
+    // `mcpEndpoint` builds /mcp, each path is set on the parsed URL, never resolved as a reference.
+    const oauth = options.publicUrl === undefined ? undefined : oauthUrls(options.publicUrl);
+    // POST /oauth/register, /oauth/approve, /oauth/token and /api/login requests between taking a slot and answering.
+    let authorizing = 0;
+    // GET /oauth/authorize requests fetching a client's metadata document, from before the fetch begins until it ends.
+    let fetchingMetadata = 0;
+    const fetchMetadata = options.fetchClientMetadata ?? ((url) => fetchClientMetadata(url));
+    /**
+     * Takes a slot for an OAuth or POST /api/login request with a body, before it is read, and answers what `act` does with
+     * the body's text (at most MAX_OAUTH_BODY_BYTES); the slot is given back at the end. A lock held past the busy timeout
+     * answers 503. /api/login uses it with or without a public URL.
+     */
+    const withOAuthBody = async (req, res, act) => {
+        if (req.method !== "POST")
+            return reply(res, 405, "Method not allowed", { Allow: "POST" });
+        if (authorizing >= maxSessions)
+            return oauthError(res, 503, "temporarily_unavailable", "Too many requests", { Connection: "close", "Retry-After": "5" });
+        authorizing++;
+        try {
+            let text;
+            try {
+                text = await readText(req, MAX_OAUTH_BODY_BYTES);
+            }
+            catch (err) {
+                if (err instanceof RangeError)
+                    return oauthError(res, 413, "invalid_request", "Request body too large");
+                throw err;
+            }
+            try {
+                act(text);
+            }
+            catch (err) {
+                if (!isBusy(err))
+                    throw err;
+                oauthError(res, 503, "temporarily_unavailable", "Database busy", { "Retry-After": "1" });
+            }
+        }
+        finally {
+            authorizing--;
+        }
+    };
+    /** POST /oauth/register: registers a public client (RFC 7591) from a JSON body, with no token. */
+    const oauthRegister = (req, res) => withOAuthBody(req, res, (text) => {
+        let body;
+        try {
+            body = JSON.parse(text);
+        }
+        catch {
+            return oauthError(res, 400, "invalid_client_metadata", "The body must be JSON.");
+        }
+        try {
+            const client = registerClient(db, body);
+            sendOAuthJson(res, 201, {
+                client_id: client.clientId,
+                ...(client.clientName === null ? {} : { client_name: client.clientName }),
+                redirect_uris: client.redirectUris,
+                grant_types: ["authorization_code"],
+                response_types: ["code"],
+                token_endpoint_auth_method: "none",
+            });
+        }
+        catch (err) {
+            if (err instanceof OAuthError)
+                return oauthError(res, 400, err.error, err.message);
+            throw err;
+        }
+    });
+    const showError = (res, message) => {
+        res.writeHead(400, APPROVE_HEADERS);
+        res.end(errorPage(message));
+    };
+    /**
+     * GET /oauth/authorize: checks the request, then shows the approval page, an error page for a client or redirect URI
+     * that is not registered, or redirects back with the error for anything else. A `client_id` that starts with https://
+     * is the URL of the client's metadata document: once the URL is checked, a slot is taken and the document fetched,
+     * outside any transaction and with nothing of this request; a URL, fetch or document refused gets the error page with
+     * a fixed reason, never a redirect.
+     */
+    const oauthAuthorize = async (req, res, resource) => {
+        if (req.method !== "GET")
+            return reply(res, 405, "Method not allowed", { Allow: "GET" });
+        const query = new URL(req.url ?? "", "http://x").searchParams;
+        const ids = query.getAll("client_id");
+        let fetched;
+        if (ids.length === 1 && isMetadataUrl(ids[0])) {
+            let url;
+            try {
+                url = checkMetadataUrl(ids[0]);
+            }
+            catch (err) {
+                if (err instanceof OAuthError)
+                    return showError(res, err.message);
+                throw err;
+            }
+            // An HTML page, not an OAuth error's JSON as for the other caps: this request is a person's browser.
+            if (fetchingMetadata >= maxSessions) {
+                res.writeHead(503, { ...APPROVE_HEADERS, "Retry-After": "5" });
+                return void res.end(errorPage("Too many clients are connecting at once. Try again in a moment."));
+            }
+            fetchingMetadata++;
+            let doc;
+            try {
+                doc = await fetchMetadata(url);
+            }
+            catch {
+                return showError(res, "This server could not fetch the client's description. Start connecting again from the client.");
+            }
+            finally {
+                fetchingMetadata--;
+            }
+            try {
+                fetched = clientFromMetadata(url, doc);
+            }
+            catch (err) {
+                if (err instanceof OAuthError)
+                    return showError(res, err.message);
+                throw err;
+            }
+        }
+        const outcome = unlessBusy(res, () => startAuthorization(db, query, resource, fetched));
+        if (outcome === undefined)
+            return;
+        if (outcome.page === "redirect") {
+            res.writeHead(302, { Location: outcome.location, "Cache-Control": "no-store", "Referrer-Policy": "no-referrer" });
+            return void res.end();
+        }
+        if (outcome.page === "error")
+            return showError(res, outcome.message);
+        const { authorization: a } = outcome;
+        res.writeHead(200, APPROVE_HEADERS);
+        res.end(approvePage(a, redirectTo(a.redirectUri, { error: "access_denied" }, a.state), oauth?.signin === true));
+    };
+    /** Who `access`, a full or person token's, approves as: its account's name and, for a person token, its person's. */
+    const signedInAs = (access) => ({
+        account: accountName(db, access.account),
+        ...(access.person && { person: access.person.name }),
+    });
+    /**
+     * POST /oauth/approve: `{ request, state, agent, fresh, as }` from the approval page, with a full or person token of the
+     * account the client's agent is made or found in. `fresh: true` says `agent` is the name the page suggested, left as
+     * it was, so a live agent of that name is refused rather than connected as. `registers: true` in place of `agent`
+     * approves a client that registers its own agents, so its token is bound to no agent. Signed in by the cookie (`signedIn`, who
+     * GET /oauth/signin says it signs in as now), `as` must be the `{ account, person? }` the page showed, so a sign-in
+     * that changed since the page showed it is refused with 409 rather than approving into another account. Answers
+     * `{ location }`, the redirect URI with the code, or 400 or 409 with the reason.
+     */
+    const oauthApprove = (req, res, account, signedIn) => withOAuthBody(req, res, (text) => {
+        let input;
+        try {
+            input = JSON.parse(text);
+        }
+        catch {
+            input = undefined;
+        }
+        const state = input?.state;
+        const registers = input?.registers === true;
+        if (typeof input?.request !== "string" ||
+            (registers ? input.agent !== undefined : typeof input.agent !== "string") ||
+            (state !== null && typeof state !== "string")) {
+            return sendOAuthJson(res, 400, { message: "Give request, state and agent, or registers: true in place of agent." });
+        }
+        const fresh = input.fresh === true;
+        const as = input.as;
+        if (signedIn && (typeof as !== "object" || as === null || as.account !== signedIn.account || (as.person ?? undefined) !== signedIn.person)) {
+            return sendOAuthJson(res, 409, { message: "This browser is now signed in as someone else. Check who approves, then approve again." });
+        }
+        try {
+            sendOAuthJson(res, 200, { location: approveAuthorization(db, account, input.request, state, registers ? null : input.agent, fresh) });
+        }
+        catch (err) {
+            if (err instanceof OAuthError || err instanceof ToolError)
+                return sendOAuthJson(res, 400, { message: err.message });
+            throw err;
+        }
+    });
+    /**
+     * /oauth/signin: the approval page's sign-in, a cookie holding the dashboard's token, `HttpOnly` so no page script reads
+     * it, `SameSite=Strict` so the browser sends it only on requests from this site, `Secure`, and sent only under the
+     * approval page's path. It exists only under an https public URL (`signin` in `oauthUrls`). Every method needs a request from this server's own origin (`sameOrigin`).
+     * POST, from the dashboard once a token is confirmed, sets it to the request's bearer token, which must be a full or
+     * person token (403 for any other, 401 for none). GET, from the approval page, answers who the cookie's token signs in
+     * as: `{ account, person? }`, with `name`, a name for the client's agent no live agent or person of the account has,
+     * made from the query's `base` when it gives one; a missing or refused cookie gets 401 (and a refused one is cleared).
+     * DELETE, from the dashboard's "Forget token", clears it. The token is checked afresh on each GET and approval, so a
+     * revoked token stops at the next request.
+     */
+    const oauthSignin = (req, res, o) => {
+        if (req.method !== "GET" && req.method !== "POST" && req.method !== "DELETE") {
+            return reply(res, 405, "Method not allowed", { Allow: "GET, POST, DELETE" });
+        }
+        if (!sameOrigin(req, o.origin))
+            return reply(res, 403, "Only this server's own pages can sign in");
+        const attributes = `Path=${o.cookiePath}; HttpOnly; SameSite=Strict; Secure`;
+        const clear = `${SIGNIN_COOKIE}=; ${attributes}; Max-Age=0`;
+        const noStore = { "Cache-Control": "no-store" };
+        if (req.method === "DELETE") {
+            res.writeHead(204, { "Set-Cookie": clear, ...noStore });
+            return void res.end();
+        }
+        if (req.method === "POST") {
+            const m = /^bearer +(.*)$/i.exec(req.headers.authorization ?? "");
+            const access = accountOf(db, req.headers.authorization, options.token);
+            if (!m || access === undefined)
+                return reply(res, 401, "Unauthorized");
+            if (access.agentOnly || access.readOnly)
+                return reply(res, 403, "Only a full or person token can approve a client");
+            res.writeHead(204, { "Set-Cookie": `${SIGNIN_COOKIE}=${encodeURIComponent(m[1])}; ${attributes}`, ...noStore });
+            return void res.end();
+        }
+        const token = signinCookie(req.headers.cookie);
+        const query = new URL(req.url ?? "", "http://x").searchParams;
+        const bases = query.getAll("base");
+        const base = bases.length === 1 && /^[a-z0-9_-]{1,24}$/.test(bases[0]) ? bases[0] : undefined;
+        const answer = unlessBusy(res, () => {
+            const access = token === undefined ? undefined : accountForToken(db, token, options.token);
+            if (access === undefined || access.agentOnly || access.readOnly)
+                return null;
+            const name = base === undefined ? undefined : freeAgentName(db, access.account, base);
+            return { ...signedInAs(access), ...(name !== undefined && { name }) };
+        });
+        if (answer === undefined)
+            return;
+        if (answer === null) {
+            return reply(res, 401, "Not signed in", token === undefined ? noStore : { "Set-Cookie": clear, ...noStore });
+        }
+        res.writeHead(200, { "Content-Type": "application/json", ...noStore });
+        res.end(JSON.stringify(answer));
+    };
+    /** POST /oauth/token: exchanges a code for an agent token, from a form-encoded body (`authorization_code` only). */
+    const oauthToken = (req, res) => withOAuthBody(req, res, (text) => {
+        const form = new URLSearchParams(text);
+        const one = (key) => {
+            const values = form.getAll(key);
+            return values.length === 1 ? values[0] : undefined;
+        };
+        if (form.getAll("grant_type").length !== 1)
+            return oauthError(res, 400, "invalid_request", "Give grant_type once.");
+        if (one("grant_type") !== "authorization_code")
+            return oauthError(res, 400, "unsupported_grant_type", "Only authorization_code is supported.");
+        const [code, clientId, redirectUri, verifier] = ["code", "client_id", "redirect_uri", "code_verifier"].map(one);
+        const resources = form.getAll("resource");
+        if (!code || !clientId || !redirectUri || !verifier || resources.length > 1) {
+            return oauthError(res, 400, "invalid_request", "Give code, client_id, redirect_uri and code_verifier once each, and resource at most once.");
+        }
+        let token;
+        try {
+            token = exchangeCode(db, { code, clientId, redirectUri, verifier, resource: resources[0] ?? null });
+        }
+        catch (err) {
+            if (err instanceof OAuthError)
+                return oauthError(res, 400, err.error, err.message);
+            throw err;
+        }
+        sendOAuthJson(res, 200, { access_token: token, token_type: "Bearer" });
+    });
+    /**
+     * POST /api/login: `{ code }`, a one-time code from a `message-cp login-link` link or an invite, with no token. Answers
+     * `{ session }`, the id of a dashboard sign-in session for a new full or person token of the code's account (the token
+     * itself is returned to nobody), or 400 with `reason` "cancelled" (an invite an admin cancelled), "used" or "invalid"
+     * and a message that never quotes the code.
+     */
+    const apiLogin = (req, res) => withOAuthBody(req, res, (text) => {
+        let code;
+        try {
+            code = JSON.parse(text)?.code;
+        }
+        catch {
+            code = undefined;
+        }
+        if (typeof code !== "string")
+            return sendOAuthJson(res, 400, { reason: "invalid", message: "Give code." });
+        try {
+            sendOAuthJson(res, 200, { session: redeemLoginCode(db, code) });
+        }
+        catch (err) {
+            if (err instanceof LoginRefused)
+                return sendOAuthJson(res, 400, { reason: err.reason, message: err.message });
+            throw err;
+        }
+    });
+    const handle = async (req, res) => {
+        const path = (req.url ?? "").split("?")[0];
+        // The dashboard page is the same constant for everyone and holds no data, so it comes before the token.
+        if (req.method === "GET" && path === "/") {
+            res.writeHead(200, DASHBOARD_HEADERS);
+            return void res.end(DASHBOARD_HTML);
+        }
+        // The dashboard's fonts are the same bytes for everyone, read when the module loaded, and found by exact path only, so
+        // they too come before the token. The paths carry no version and a package upgrade can change the bytes, so caches keep a
+        // font for a day and are not told it is immutable.
+        const font = req.method === "GET" ? DASHBOARD_FONTS.get(path) : undefined;
+        if (font) {
+            res.writeHead(200, {
+                "Content-Type": "font/woff2",
+                "X-Content-Type-Options": "nosniff",
+                "Cache-Control": "public, max-age=86400",
+            });
+            return void res.end(font);
+        }
+        // The health check is the same constant for everyone, reads nothing and touches no account, so it too comes before the token.
+        if (path === "/health") {
+            if (req.method !== "GET")
+                return reply(res, 405, "Method not allowed", { Allow: "GET" });
+            return sendJson(res, { ok: true });
+        }
+        // The authorization flow's metadata, registration, authorization page and token endpoint are the same for everyone and
+        // reveal no account, so they too come before the token; without a public URL none of them exists.
+        if (oauth && (oauth.serverPaths.has(path) || oauth.resourcePaths.has(path))) {
+            if (req.method !== "GET")
+                return reply(res, 405, "Method not allowed", { Allow: "GET" });
+            return sendJson(res, oauth.serverPaths.has(path) ? oauth.server : oauth.resource);
+        }
+        if (oauth && path === "/oauth/register")
+            return oauthRegister(req, res);
+        if (oauth && path === "/oauth/authorize")
+            return oauthAuthorize(req, res, oauth.resource.resource);
+        if (oauth && path === "/oauth/token")
+            return oauthToken(req, res);
+        // The sign-in cookie is checked by its own route, which checks any token it is given itself.
+        if (oauth?.signin && path === "/oauth/signin")
+            return oauthSignin(req, res, oauth);
+        // A full or person token approves a client, into its own account: an agent or read-only token is refused before a slot is
+        // taken or a body read. The token is the request's Authorization header, as for every other path; only a request with
+        // none, from a page of this server's own origin, is signed in by the sign-in cookie instead (under an https public URL
+        // only), so another site cannot make a signed-in browser approve, and a script's Bearer token works as before.
+        if (oauth && path === "/oauth/approve") {
+            const cookie = oauth.signin && req.headers.authorization === undefined && sameOrigin(req, oauth.origin) ? signinCookie(req.headers.cookie) : undefined;
+            const access = cookie === undefined ? accountOf(db, req.headers.authorization, options.token) : accountForToken(db, cookie, options.token);
+            if (access === undefined)
+                return reply(res, 401, "Unauthorized", { "WWW-Authenticate": oauth.challenge, Connection: "close" });
+            if (access.agentOnly || access.readOnly) {
+                return reply(res, 403, "Only a full or person token can approve a client", { Connection: "close" });
+            }
+            return oauthApprove(req, res, access.account, cookie === undefined ? undefined : signedInAs(access));
+        }
+        // A login link's code stands in for the token, and redeeming it reveals nothing of any account but to its holder, so
+        // it too comes before the token, with or without a public URL.
+        if (path === "/api/login")
+            return apiLogin(req, res);
+        // The token is the first thing any other request meets, and decides the account everything after it acts as.
+        const access = accountOf(db, req.headers.authorization, options.token);
+        if (access === undefined) {
+            return reply(res, 401, "Unauthorized", { "WWW-Authenticate": oauth ? oauth.challenge : "Bearer" });
+        }
+        const { account } = access;
+        // A listen token (`issueListenToken`) only waits for its own agent's mail on GET /wait; `wait` refuses another agent.
+        // Anything else is refused before a slot is taken or a body read.
+        if (access.listen && path !== "/wait")
+            return reply(res, 403, "A listen token only waits on GET /wait", { Connection: "close" });
+        // A POST or PATCH to /api/people or /api/invites carries a body its 403 leaves unread, so their 403s close the
+        // connection.
+        const inviting = path === "/api/people" || path === "/api/invites";
+        // Removing an agent and resetting its key, which only an admin person token does; GET /api/agents is a read, and any
+        // other method there gets apiAgents' 405. Neither reads a body; their 403s close the connection as the routes above do.
+        const managing = (path === "/api/agents" && req.method === "DELETE") || path === "/api/agents/key";
+        // Listing, adding and removing webhooks, which only an admin person token does. A POST carries a body the token
+        // refusals below leave unread; those 403s close the connection as the routes above do.
+        const hooks = path === "/api/webhooks";
+        // Revoking an approved client, which only an admin person token does; any other method on /api/approvals is a read,
+        // or apiApprovals' 405. It reads no body; its 403s close the connection as the routes above do.
+        const revoking = path === "/api/approvals" && req.method === "DELETE";
+        // Listing, making and revoking the account's tokens, which only an admin person token does. A POST carries a body its
+        // 403 leaves unread, so their 403s close the connection as the routes above do.
+        const tokens = path === "/api/tokens";
+        // Listing and ending the account's dashboard sign-ins, which only an admin person token or sign-in does. Neither
+        // method reads a body; their 403s close the connection as the routes above do.
+        const signins = path === "/api/signins";
+        // An agent token reaches /mcp and /wait, where it reads as its agent does, and of the /api paths only GET /api/token,
+        // so the dashboard can say why it will not work; it cannot read or delete the account's conversations there. It is
+        // refused before a slot is taken or a body read.
+        if (access.agentOnly &&
+            (path === "/api" || path.startsWith("/api/")) &&
+            !(path === "/api/token" && req.method === "GET")) {
+            return reply(res, 403, "Agent tokens cannot use the dashboard API", inviting || managing || hooks || revoking || tokens || signins ? { Connection: "close" } : {});
+        }
+        // A dashboard sign-in session (a login link's or an invite's) reaches what its token reaches but /mcp and /wait, so the
+        // session itself never acts as an agent. It is refused before a slot is taken or a body read.
+        if (access.session !== undefined && (path === "/mcp" || path === "/wait")) {
+            return reply(res, 403, "A dashboard sign-in cannot use MCP or /wait", { Connection: "close" });
+        }
+        if (path === "/api/token")
+            return apiToken(req, res, access);
+        if (path === "/api/agents" && !managing)
+            return apiAgents(req, res, account);
+        if (path === "/api/channels")
+            return apiChannels(req, res, account);
+        if (path === "/api/channel-posts")
+            return apiChannelPosts(req, res, account);
+        if (path === "/api/messages")
+            return apiMessages(req, res, account);
+        if (path === "/api/search")
+            return apiSearch(req, res, account);
+        if (path === "/api/webhook-deliveries")
+            return apiWebhookDeliveries(req, res, account);
+        if (path === "/api/approvals" && !revoking)
+            return apiApprovals(req, res, account);
+        // A read-only token reaches the read-only endpoints above and nothing else: /mcp can write, and so can any path added later.
+        if (access.readOnly)
+            return reply(res, 403, "This token is read-only", inviting || managing || hooks || revoking || tokens || signins ? { Connection: "close" } : {});
+        // A person token also sends and posts, only as its person (checked by row once the body is read), approves clients
+        // (above), and, while its person is an admin, deletes the account's conversations as a full token does, lists, adds,
+        // marks, unmarks and removes people, makes, lists and cancels invites, removes agents and resets their keys, lists,
+        // adds and removes webhooks, revokes approved clients, lists, makes (read-only and agent only) and revokes the
+        // account's tokens, and lists and ends its dashboard sign-ins. It reaches nothing else: not /mcp, /wait, nor any path
+        // added later. It is refused before a slot is taken or a body read.
+        if (access.person &&
+            path !== "/api/send" &&
+            path !== "/api/post" &&
+            !(access.person.admin && (inviting || managing || hooks || revoking || tokens || signins || path === "/api/conversation"))) {
+            return reply(res, 403, access.person.admin
+                ? "An admin person token only reads, sends, posts, deletes, invites, changes people, manages agents, webhooks, tokens and sign-ins and revokes approved clients"
+                : "A person token only reads, sends and posts", { Connection: "close" });
+        }
+        // Only a person token sends and posts, as its own person, so nobody acts as another person: a full token, which has
+        // no person, is refused before a slot is taken or a body read.
+        if (path === "/api/send" || path === "/api/post") {
+            if (!access.person)
+                return reply(res, 403, FULL_TOKEN_SENDS, { Connection: "close" });
+            return (path === "/api/send" ? apiSend : apiPost)(req, res, account, access.person.id);
+        }
+        // Only an admin person lists, adds, marks, unmarks and removes people and makes, lists and cancels invites: a full
+        // token, which is no person, is refused before a slot is taken or a body read. A plain person token was refused above.
+        if (inviting) {
+            if (!access.person)
+                return reply(res, 403, FULL_TOKEN_INVITES, { Connection: "close" });
+            return (path === "/api/people" ? apiPeople : apiInvites)(req, res, account, access.person.id);
+        }
+        // Likewise only an admin person removes agents and resets their keys; a full token is refused before anything runs.
+        if (managing) {
+            if (!access.person)
+                return reply(res, 403, FULL_TOKEN_AGENTS, { Connection: "close" });
+            return (path === "/api/agents" ? apiRemoveAgent : apiAgentKey)(req, res, account, access.person.id);
+        }
+        // And only an admin person lists, adds and removes webhooks over the API; a full token is refused before a slot is
+        // taken or a body read.
+        if (hooks) {
+            if (!access.person)
+                return reply(res, 403, FULL_TOKEN_WEBHOOKS, { Connection: "close" });
+            return apiWebhooks(req, res, account, access.person.id);
+        }
+        // And only an admin person revokes approved clients over the API; a full token is refused before anything runs.
+        if (revoking) {
+            if (!access.person)
+                return reply(res, 403, FULL_TOKEN_APPROVALS, { Connection: "close" });
+            return apiRevokeApproval(req, res, account, access.person.id);
+        }
+        // And only an admin person lists, makes and revokes tokens over the API; a full token is refused before a slot is
+        // taken or a body read.
+        if (tokens) {
+            if (!access.person)
+                return reply(res, 403, FULL_TOKEN_TOKENS, { Connection: "close" });
+            return apiTokens(req, res, account, access.person.id);
+        }
+        // And only an admin person lists and ends dashboard sign-ins; a full token is refused before anything runs.
+        if (signins) {
+            if (!access.person)
+                return reply(res, 403, FULL_TOKEN_SIGNINS, { Connection: "close" });
+            return apiSignins(req, res, account, access.person.id, access.session);
+        }
+        if (path === "/api/conversation")
+            return apiConversation(req, res, account);
+        if (path === "/wait")
+            return wait(req, res, account, access.agent, access.registers);
+        if (path !== "/mcp")
+            return reply(res, 404, "Not found");
+        if (req.method !== "POST" && req.method !== "GET" && req.method !== "DELETE") {
+            return reply(res, 405, "Method not allowed", { Allow: "GET, POST, DELETE" });
+        }
+        const header = req.headers["mcp-session-id"];
+        const id = Array.isArray(header) ? header[0] : header;
+        // A session id this server does not hold may be one a server before it gave out: one that registered is restored
+        // if it still may be. Anything else is answered at once, so that only a restore can meet the cap below.
+        if (id && !sessions.has(id)) {
+            const identity = unlessBusy(res, () => restorableSession(db, id, account, Date.now() - idleTimeoutMs) ?? null);
+            if (identity === undefined)
+                return;
+            // A token bound to an agent restores only a session of that agent, and one that registers its own agents only a
+            // session of one of them; any other looks like one that does not exist.
+            if (identity === null || !mayActAs(db, access, identity)) {
+                return reply(res, 404, "Unknown session", { Connection: "close" });
+            }
+            if (sessions.size + initializing >= maxSessions)
+                return reply(res, 503, "Too many sessions", { Connection: "close" });
+            restore(id, account, identity, access.approval !== undefined);
+        }
+        // A request without a session may name the agent its new session acts as. A malformed pair is answered before the
+        // cap, so the cap limits only work that can go ahead, closing the connection so its unread body cannot hold it open.
+        const named = id ? undefined : agentHeaders(req);
+        if (named === null) {
+            return reply(res, 400, "Send both X-Message-CP-Agent and X-Message-CP-Agent-Key once each, or neither", {
+                Connection: "close",
+            });
+        }
+        // A token bound to an agent acts as it with no headers; headers naming another agent are refused before the cap.
+        if (named && access.agent && named.name.toLowerCase() !== access.agent.name.toLowerCase()) {
+            return reply(res, 403, `This token acts only as agent '${access.agent.name}'`, { Connection: "close" });
+        }
+        // A token that registers its own agents takes no key, and headers always carry one: its sessions call `register`.
+        if (named && access.registers !== undefined) {
+            return reply(res, 403, "This token registers its own agents: call register instead of sending agent headers", { Connection: "close" });
+        }
+        // A request without a session can only start one. Refuse it at the cap, closing the connection so an unread
+        // body cannot hold it open; otherwise take a slot now, before the body is buffered, and give it back at the end.
+        if (!id && sessions.size + initializing >= maxSessions) {
+            return reply(res, 503, "Too many sessions", { Connection: "close" });
+        }
+        // A request for a session takes a slot before its body is read, once the session is known to be the token's account's
+        // (another account's looks like one that does not exist), and gives it back as soon as the body has been read, so a
+        // tool call held open afterwards does not keep it.
+        if (id) {
+            const live = sessions.get(id);
+            if (!live || live.account !== account || !mayActAs(db, access, live.session?.registration)) {
+                return reply(res, 404, "Unknown session", { Connection: "close" });
+            }
+        }
+        let slot = !!id && req.method === "POST";
+        if (slot && reading >= maxSessions)
+            return reply(res, 503, "Too many requests", { Connection: "close" });
+        if (slot)
+            reading++;
+        const bodyRead = () => {
+            if (slot)
+                reading--;
+            slot = false;
+        };
+        const reserved = !id && req.method === "POST";
+        if (reserved)
+            initializing++;
+        try {
+            await serve(req, res, id, access, named, bodyRead);
+        }
+        finally {
+            bodyRead();
+            if (reserved)
+                initializing--;
+        }
+    };
+    const serve = async (req, res, id, access, named, bodyRead) => {
+        const { account, agent: bound, registers, approval } = access;
+        // Tools read the token's agent from here, so a bound token cannot `register` or remove another name on any session,
+        // the row id of a token that registers its own agents, so it registers and removes only its own, and the row id of
+        // an approval's token, which `register` and `listen_token` issue a listen token through.
+        const extra = { ...(bound && { agent: bound.name }), ...(registers !== undefined && { registers }), ...(approval !== undefined && { approval }) };
+        if (Object.keys(extra).length > 0)
+            req.auth = { token: "", clientId: "", scopes: [], extra };
+        let body;
+        if (req.method === "POST") {
+            try {
+                body = await readBody(req);
+            }
+            catch (err) {
+                return err instanceof RangeError ? reply(res, 413, "Request body too large") : reply(res, 400, "Invalid JSON");
+            }
+            finally {
+                bodyRead?.();
+            }
+        }
+        if (id) {
+            const live = sessions.get(id);
+            // Another account's session looks like one that does not exist, as does another agent's to a bound token, or to a
+            // token that registers its own agents.
+            if (!live || live.account !== account || !mayActAs(db, access, live.session?.registration)) {
+                return reply(res, 404, "Unknown session");
+            }
+            await live.ready;
+            // A client that went away while the session was restored is not listening, and its close has already fired, so
+            // `track` would never see it.
+            if (res.closed)
+                return;
+            // A session another server sharing the database ended with DELETE is ended here too.
+            const ended = unlessBusy(res, () => sessionEnded(db, id));
+            if (ended === undefined)
+                return;
+            if (ended) {
+                drop(id);
+                return reply(res, 404, "Unknown session");
+            }
+            live.lastUsed = Date.now();
+            track(live, res, body);
+            await live.transport.handleRequest(req, res, body);
+            live.lastUsed = Date.now();
+            // A session dropped by close() while a request was open keeps its row, so the restart can restore it; any other
+            // request keeps a registered one restorable for another idle timeout.
+            if (req.method !== "DELETE" && sessions.get(id) === live)
+                recordSession(() => touchSession(db, id, live.lastUsed));
+            return;
+        }
+        if (req.method !== "POST" || !isInitializeRequest(body)) {
+            return reply(res, 400, "Send an initialize request first");
+        }
+        // Registers the named agent as `register` would, in the token's account. A refusal is 403, not 401, so a client
+        // does not take it for a bad token; its message names no key.
+        let identity;
+        if (named) {
+            let registered;
+            try {
+                registered = unlessBusy(res, () => registerWithIdentity(db, account, named.name, undefined, named.key));
+            }
+            catch (err) {
+                if (err instanceof ToolError)
+                    return reply(res, 403, err.message);
+                throw err;
+            }
+            if (registered === undefined)
+                return;
+            identity = registered.identity;
+        }
+        else if (bound) {
+            identity = { id: bound.id, registeredAt: bound.registeredAt, instance: bound.instance };
+        }
+        const live = { lastUsed: Date.now(), transport: undefined, account, open: new Map() };
+        const transport = new StreamableHTTPServerTransport({
+            sessionIdGenerator: () => randomUUID(),
+            onsessioninitialized: (sid) => {
+                sessions.set(sid, live);
+                // Now that the session is held, binding it records it, as a `register` on it would.
+                if (identity)
+                    session.bind(identity);
+            },
+            onsessionclosed: endRecorded,
+        });
+        live.transport = transport;
+        transport.onclose = () => {
+            if (transport.sessionId)
+                sessions.delete(transport.sessionId);
+        };
+        // Only a session this server still holds is recorded: a `register` that finishes after a DELETE ended it, before it
+        // had a row to mark, must not make it restorable.
+        const session = new Session(account, (identity) => {
+            const sid = transport.sessionId;
+            if (sessions.get(sid) === live)
+                recordSession(() => saveSession(db, sid, account, identity));
+        });
+        live.session = session;
+        await createServer(db, session, { ...serverOptions(live), agent: bound?.name, approval: approval !== undefined }).connect(transport);
+        await transport.handleRequest(req, res, body);
+    };
+    /**
+     * Notes each JSON-RPC request in a POST body as open until its response closes, whether answered or abandoned by the
+     * client, so a held tool call can stop. A later request reusing an id replaces the entry, and is the one kept.
+     */
+    const track = (live, res, body) => {
+        for (const message of Array.isArray(body) ? body : [body]) {
+            if (!isJSONRPCRequest(message))
+                continue;
+            const controller = new AbortController();
+            live.open.set(message.id, controller);
+            res.once("close", () => {
+                controller.abort();
+                if (live.open.get(message.id) === controller)
+                    live.open.delete(message.id);
+            });
+        }
+    };
+    /**
+     * Called by a transport once it has accepted a DELETE, before it answers. If the session cannot be marked ended, this
+     * throws, so the transport answers 500 instead of 200. The row stays restorable, so the DELETE can be sent again.
+     */
+    const endRecorded = (sid) => endSession(db, sid);
+    /**
+     * Holds session `id` again, bound to `identity`, which `restorableSession` has just checked. It takes its place in
+     * `sessions` at once, so it counts against the cap and a second request on it waits for this one; if it cannot be
+     * initialized it is dropped again. `approval` is whether the request's token came from an approval, so the session
+     * offers `listen_token`.
+     */
+    const restore = (id, account, identity, approval) => {
+        const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: () => id, onsessionclosed: endRecorded });
+        const live = { lastUsed: Date.now(), transport, account, open: new Map() };
+        sessions.set(id, live);
+        transport.onclose = () => {
+            if (sessions.get(id) === live)
+                sessions.delete(id);
+        };
+        // Its row is already there, so it is not recorded again: one another server deleted meanwhile stays deleted. The
+        // session is set at once, so a bound token's request on it meanwhile can check whose it is.
+        const session = new Session(account, (bound) => {
+            if (sessions.get(id) === live)
+                recordSession(() => saveSession(db, id, account, bound));
+        });
+        session.restore(identity);
+        live.session = session;
+        live.ready = (async () => {
+            try {
+                await createServer(db, session, { ...serverOptions(live), approval }).connect(transport);
+                await prime(transport);
+            }
+            catch (err) {
+                drop(id);
+                throw err;
+            }
+        })();
+        // Each request awaits it and answers 500 if it failed; this keeps the failure from going unhandled meanwhile.
+        live.ready.catch(() => { });
+    };
+    const server = createHttpServer((req, res) => {
+        handle(req, res).catch((err) => {
+            console.error(`message-cp serve: ${err instanceof Error ? err.message : String(err)}`);
+            if (!res.headersSent)
+                reply(res, 500, "Internal error");
+            else
+                res.end();
+        });
+    });
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(options.port ?? DEFAULT_HTTP_PORT, options.host ?? DEFAULT_HTTP_HOST, () => resolve());
+    });
+    const address = server.address();
+    const port = typeof address === "object" && address ? address.port : (options.port ?? DEFAULT_HTTP_PORT);
+    return {
+        server,
+        port,
+        sessionCount: () => sessions.size,
+        close: async () => {
+            clearInterval(sweep);
+            clearInterval(deliver);
+            stopping.abort();
+            await sending;
+            for (const id of [...sessions.keys()])
+                drop(id);
+            server.closeAllConnections();
+            await new Promise((resolve) => server.close(() => resolve()));
+        },
+    };
+}